mcp-noaa-ndbcSAFE
NOAA NDBC MCP — National Data Buoy Center marine observations
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Observed marine conditions from NOAA's National Data Buoy Center — ~1,350 active moored buoys, coastal C-MAN stations, DART tsunami stations and partner platforms reporting wave height, wave period, sea-surface temperature, wind and pressure.
Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.
Tools
ndbc_stations(bbox?, near_latitude?, near_longitude?, name_contains?, owner?, type?, has_met?, has_waterquality?, has_currents?, limit?)— the active-station inventory, distance-ranked when a point is given.ndbc_latest_obs(station_id)— the newest standard meteorological observation at one station.ndbc_station_history(station_id, hours?, limit?)— up to ~45 days of rows, newest first.
Auth
Keyless. NDBC serves nothing without a User-Agent, which this pack always sends.
Data sources
https://www.ndbc.noaa.gov/activestations.xml— active-station inventory.https://www.ndbc.noaa.gov/data/realtime2/.txt— last ~45 days of observations.
Things the next person would otherwise rediscover:
- Missing values are the literal string `MM`, not an empty field. Every
numeric here is null when the station did not report it; a buoy reporting wind but no wave height is normal.
- realtime2 rows are NEWEST FIRST. Row 0 is the latest.
- Two
#header lines, the first names columns and the second units. Columns
are parsed positionally because some partner stations abbreviate the header.
- Not every active station has a realtime2 file. DART and water-quality-only
platforms 404 there. That is a coverage fact about the station, and ndbc_latest_obs says so rather than reporting an outage.
Quick Start
Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
{
"mcpServers": {
"noaa-ndbc": {
"url": "https://gateway.pipeworx.io/noaa-ndbc/mcp"
}
}
}What this endpoint actually serves
tools/list at `https
022558a1472eOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-noaa-ndbc -- npx -y @pipeworx/[email protected]
{
"mcpServers": {
"mcp-noaa-ndbc": {
"command": "npx",
"args": [
"-y",
"@pipeworx/[email protected]"
]
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ndbc_station_history | read | Recent observation time series for one NDBC station — up to the last ~45 days of standard meteorological rows at the station reporting interval (usually every 10 minutes for buoys, hourly for some partners). Use for trends: |
ndbc_stations | read | List active NOAA National Data Buoy Center stations — moored buoys, coastal C-MAN sites, tsunami DART stations and partner platforms — filtered by bounding box, name, owner, type or the measurements they carry. AUTHORITATIVE for |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, tsx, typescript, @cloudflare/workers-types
Gates applied: no_behavioural_pass.
022558a1472efull audit observations/trust-audit/mcp-server/pipeworx-io__mcp-noaa-ndbc.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 022558a1472e | SAFE | B | 89 | first audit |
Questions
What is the mcp-noaa-ndbc MCP server?
NOAA NDBC MCP — National Data Buoy Center marine observations
What tools does mcp-noaa-ndbc expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-noaa-ndbc safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-noaa-ndbc need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-noaa-ndbc run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeworx/mcp-noaa-ndbc at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (022558a1472e), read on 2026-10-11. The repository is watched and re-audited when it changes.